mail.ictpack.net Open in urlscan Pro
170.10.163.247  Malicious Activity! Public Scan

URL: http://mail.ictpack.net/outlookmail/auth/
Submission: On February 18 via automatic, source openphish — Scanned from DE

Summary

This website contacted 1 IPs in 1 countries across 1 domains to perform 4 HTTP transactions. The main IP is 170.10.163.247, located in United States and belongs to STEADFAST, US. The main domain is mail.ictpack.net.
This is the only time mail.ictpack.net was scanned on urlscan.io!

urlscan.io Verdict: Potentially Malicious

Targeting these brands: Outlook Web Access (Online)

Domain & IP information

IP Address AS Autonomous System
1 5 170.10.163.247 32748 (STEADFAST)
4 1
Apex Domain
Subdomains
Transfer
5 ictpack.net
mail.ictpack.net
58 KB
4 1
Domain Requested by
5 mail.ictpack.net 1 redirects mail.ictpack.net
4 1

This site contains no links.

Subject Issuer Validity Valid

This page contains 1 frames:

Primary Page: http://mail.ictpack.net/outlookmail/auth/
Frame ID: 43A08BB29B245F519CB33832CD3019F1
Requests: 4 HTTP requests in this frame

Screenshot

Page Title

Document

Page URL History Show full URLs

  1. http://mail.ictpack.net/outlookmail/auth HTTP 301
    http://mail.ictpack.net/outlookmail/auth/ Page URL

Page Statistics

4
Requests

0 %
HTTPS

0 %
IPv6

1
Domains

1
Subdomains

1
IPs

1
Countries

58 kB
Transfer

132 kB
Size

1
Cookies

Page URL History

This captures the URL locations of the websites, including HTTP redirects and client-side redirects via JavaScript or Meta fields.

  1. http://mail.ictpack.net/outlookmail/auth HTTP 301
    http://mail.ictpack.net/outlookmail/auth/ Page URL

Redirected requests

There were HTTP redirect chains for the following requests:

4 HTTP transactions

Resource
Path
Size
x-fer
Type
MIME-Type
Primary Request /
mail.ictpack.net/outlookmail/auth/
Redirect Chain
  • http://mail.ictpack.net/outlookmail/auth
  • http://mail.ictpack.net/outlookmail/auth/
466 B
820 B
Document
General
Full URL
http://mail.ictpack.net/outlookmail/auth/
Protocol
HTTP/1.1
Server
170.10.163.247 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ictpack.com
Software
LiteSpeed / PHP/7.4.33
Resource Hash
c33f1d79ff8a5225bb8136d5dc85c3bd138566184a0345b41301f06ff2bbca66

Request headers

Upgrade-Insecure-Requests
1
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36
accept-language
de-DE,de;q=0.9

Response headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
cache-control
no-store, no-cache, must-revalidate
content-encoding
gzip
content-length
311
content-type
text/html; charset=UTF-8
date
Sat, 18 Feb 2023 01:06:24 GMT
expires
Thu, 19 Nov 1981 08:52:00 GMT
pragma
no-cache
server
LiteSpeed
vary
Accept-Encoding
x-powered-by
PHP/7.4.33

Redirect headers

Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
707
content-type
text/html
date
Sat, 18 Feb 2023 01:06:24 GMT
location
http://mail.ictpack.net/outlookmail/auth/
server
LiteSpeed
captcha.js
mail.ictpack.net/outlookmail/auth/assets/js/
118 KB
43 KB
Script
General
Full URL
http://mail.ictpack.net/outlookmail/auth/assets/js/captcha.js
Requested by
Host: mail.ictpack.net
URL: http://mail.ictpack.net/outlookmail/auth/
Protocol
HTTP/1.1
Server
170.10.163.247 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ictpack.com
Software
LiteSpeed /
Resource Hash
10565764da9848dc9bb77662d6a8658cc96d1933cf671b2f173f75ca128d2948

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mail.ictpack.net/outlookmail/auth/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sat, 18 Feb 2023 01:06:24 GMT
content-encoding
gzip
last-modified
Wed, 27 Jan 2021 22:33:44 GMT
server
LiteSpeed
vary
Accept-Encoding
content-type
application/javascript
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
43239
expires
Sat, 25 Feb 2023 01:06:24 GMT
captcha.png
mail.ictpack.net/outlookmail/auth/
4 KB
5 KB
Image
General
Full URL
http://mail.ictpack.net/outlookmail/auth/captcha.png?_1676682386948
Protocol
HTTP/1.1
Server
170.10.163.247 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ictpack.com
Software
LiteSpeed / PHP/7.4.33
Resource Hash
ceb7b99e436e6a90f20a99a016329e307035aa1ead5dfca436a979b00864f311

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mail.ictpack.net/outlookmail/auth/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

pragma
no-cache
date
Sat, 18 Feb 2023 01:06:27 GMT
server
LiteSpeed
x-powered-by
PHP/7.4.33
content-type
image/png
cache-control
no-store, no-cache, must-revalidate
Connection
Keep-Alive
Keep-Alive
timeout=5, max=100
content-length
4492
expires
Thu, 19 Nov 1981 08:52:00 GMT
2134651.png
mail.ictpack.net/outlookmail/auth/
10 KB
10 KB
Image
General
Full URL
http://mail.ictpack.net/outlookmail/auth/2134651.png
Protocol
HTTP/1.1
Server
170.10.163.247 , United States, ASN32748 (STEADFAST, US),
Reverse DNS
ictpack.com
Software
LiteSpeed /
Resource Hash
ff2294f85ad59d6d537ba92d2c8054c8f824736f946714688c1f51a6a6577bd3

Request headers

accept-language
de-DE,de;q=0.9
Referer
http://mail.ictpack.net/outlookmail/auth/
User-Agent
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.5481.100 Safari/537.36

Response headers

date
Sat, 18 Feb 2023 01:06:27 GMT
last-modified
Sat, 30 Jan 2021 22:32:58 GMT
server
LiteSpeed
content-type
image/png
cache-control
public, max-age=604800
Connection
Keep-Alive
accept-ranges
bytes
Keep-Alive
timeout=5, max=100
content-length
9883
expires
Sat, 25 Feb 2023 01:06:27 GMT

Verdicts & Comments Add Verdict or Comment

Potentially malicious activity detected
Disclaimer: These verdicts should be used to detect potentially malicious websites, not as a final verdict!

urlscan

Phishing against: Outlook Web Access (Online)

5 JavaScript Global Variables

These are the non-standard "global" variables defined on the window object. These can be helpful in identifying possible client-side frameworks and code.

boolean| credentialless object| oncontentvisibilityautostatechange function| setImmediate function| clearImmediate function| Vue

1 Cookies

Domain/Path Name / Value
mail.ictpack.net/ Name: cazanova
Value: 339bab3a9f460422c3d16977629aca75d93e2bfc